drop ip $HOME_NET any -> [43.106.71.28,8.217.190.58] any (msg:"JADEPROX outbound connection to known IOC IP"; classtype:trojan-activity; sid:9902001; rev:1;)

2. IOCドメインへのDNS問い合わせを遮断する

drop dns $HOME_NET any -> any 53 (msg:"JADEPROX DNS query to known IOC domain"; dns.query; pcre:"/(^|\.)(sylverixstrategy\.com|gouvvbo\.top|claude-pro\.com|vertextrust-advisors\.com|update-trellix\.com|update-crowdstrike\.com|update-sentinelone\.com|dlrz-web\.oss-cn-beijing\.aliyuncs\.com)$/i"; classtype:trojan-activity; sid:9902002; rev:1;)

3. TLSのSNIを検査する